PT-2022-26164 · Xwiki · Xwiki Platform

Yana Oksner · Published 2022-09-16 · Updated 2023-07-10 · CVE-2022-41933

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions XWiki Platform versions 13.1RC1 through 14.6RC1 XWiki Platform versions 13.1RC1 through 14.4.3 XWiki Platform versions 13.1RC1 through 13.10.8

Description The XWiki Platform has a vulnerability where the password is stored in plain text in the database when the "reset a forgotten password" feature is used. This issue concerns XWiki 13.1RC1 and newer versions, specifically the reset password feature available from the "Forgot your password" link in the login view. The features allowing a user to change their password or for an admin to change a user password are not impacted. This vulnerability is particularly dangerous in combination with other vulnerabilities allowing data leaks of personal data from users. The problem has been patched in versions 14.6RC1, 14.4.3, and 13.10.8.

Recommendations For XWiki Platform versions 13.1RC1 through 14.6RC1, update to version 14.6RC1 or later. For XWiki Platform versions 13.1RC1 through 14.4.3, update to version 14.4.3 or later. For XWiki Platform versions 13.1RC1 through 13.10.8, update to version 13.10.8 or later. As a temporary workaround, consider manually resetting the passwords of impacted users or rolling back to a previous version of the user document. Administrators can also set properties for the migration to decide if the user password should be reset or kept but only hashed.

Exploit

Fix

Missing Authorization

Cleartext Storage of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-862

CWE-359

CWE-312

CWE-522

Related Identifiers

CVE-2022-41933

GHSA-599V-W48H-RJRM

GHSA-Q2HM-2H45-V5G3

Affected Products

Xwiki Platform

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/41xxx/CVE-2022-41933.json · Exploit
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-q2hm-2h45-v5g3 · Patch
• https://github.com/xwiki/xwiki-platform/commit/443e8398b75a1295067d74afb5898370782d863a#diff-f8a8f8ba80dfc55f044e2e60b521ce379176430ca6921b0f87b79cf682531f79L322 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-36091 · Security Note
• https://jira.xwiki.org/browse/XWIKI-19945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41933 · Security Note
• https://osv.dev/vulnerability/GHSA-599v-w48h-rjrm · Vendor Advisory
• https://jira.xwiki.org/browse/XWIKI-19869 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-41933 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q2hm-2h45-v5g3 · Vendor Advisory
• https://github.com/xwiki/xwiki-platform · Note
• https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-599v-w48h-rjrm · Note
• https://t.me/cibsecurity/53461 · Telegram Post
• https://t.me/cvenotify/38385 · Telegram Post
• https://jira.xwiki.org/browse/XWIKI-18849 · Note